Improper access controls in Tanium Enforce allow authenticated users with low privileges to read limited data they should not be able to access, with no integrity or availability impact. Enforce 2.9 before 2.9.736, 2.10 before 2.10.778, and 3.0 before 3.0.373 are affected; CVSS 3.1 scores this 4.3 as a network-reachable, low-privilege issue requiring a valid session. No public exploit code was identified at time of analysis, and the vendor has released fixed builds.
An authorization bypass (CWE-639, user-controlled key) in Netiket Information Technologies' EdoWEB lets a logged-in low-privileged user manipulate a key value to reach functionality or records that access-control lists should have restricted, exposing limited information (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Every EdoWEB build before 780-g7 is affected according to the vendor-tracked range, and exploitation first requires valid credentials - there is no anonymous path implied by the PR:L metric. The vendor has released a fix in 780-g7; there is no KEV listing and no public exploit identified at time of analysis, so priority is routine patching rather than emergency response.
Tanium Threat Response can write sensitive information into log files (CWE-532), exposing confidential data to anyone who can read the affected logs. Affected builds are Threat Response 4.17 before 4.17.327, 4.12 before 4.12.349, and 4.9 before 4.9.476; Tanium has released fixed versions. The CVSS 3.1 base score is 4.2 (MEDIUM) and the vuln.today decision label is 'this_month' - a low-to-moderate priority issue, not an emergency; no public exploit code or CISA KEV entry is reported in the supplied data. The vendor vector and the independent assessed vector differ on access path and prerequisites (network/high-privilege/user-interaction versus local/low-privilege/no-interaction), but both limit impact to confidentiality.
Relative path traversal in Dell PowerProtect Data Domain (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20) lets an attacker who already holds a high-privileged, administrative-level account and network access to the appliance manipulate files outside their intended location, producing limited integrity tampering and limited availability impact with no confidentiality loss. The privilege precondition (PR:H) is the dominant limiting factor: this is not reachable by unauthenticated or low-privileged remote users. No public exploit identified at time of analysis; vendor fixes are published in the 7.13.1.90, 8.3.1.50, 8.6.1.30 and 8.9.0.0 builds, and overall priority is low (monitor).
Session revocation bypass in @fastify/session before 11.1.6 lets an authenticated remote attacker who already holds a victim's valid signed session cookie keep that session alive after logout by winning a narrow timing race: a request that restored the session before the logout can still write its own copy of the store entry after another request's Session#destroy() has completed, recreating the destroyed identifier with its authenticated data. The default rolling: true behavior is required, no cookie theft or signature forgery is involved, and the attacker gains nothing beyond a session they could already use - the flaw extends or resurrects an existing session rather than creating initial access (CVSS 3.1 base 3.7, AV:N/AC:H/PR:L/UI:R, C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has released a fix in 11.1.6 that adds a per-session generation marker plus a conditional store write.
Local information disclosure in Tanium Threat Response Client Extension and Endpoint Configuration Toolset Solution is reachable only by a low-privileged local user and depends on a high-complexity condition outside the attacker's control, so impact is limited to low confidentiality exposure and minor availability loss. No public exploit code was identified at time of analysis, and Tanium has published fixed builds under advisory TAN-2026-056.
Nextcloud Richdocuments, the Collabora/WOPI integration for Nextcloud, at version 11.0.0 or earlier does not validate the token type on a WOPI configuration endpoint, so a holder of a valid low-privilege user or guest token can retrieve additional configuration information. The impact is limited to low confidentiality disclosure (CVSS 3.5; C:L only) and requires an authenticated token (PR:L); no public exploit is identified at time of analysis and the priority is monitor.
Recipients of a public share link in Nextcloud Collectives 4.0.0 can create pages inside the shared collective, an action the link-recipient role should not have permitted under the intended access model. The flaw is an improper access-control weakness (CWE-284) with a low integrity-only impact - no confidentiality or availability effect is described - and it is exploitable remotely by an authenticated low-privileged user per the CVSS vector (AV:N/AC:L/PR:L/UI:R). Only 4.0.0 is listed as affected, no public exploit code has been identified at time of analysis (the sole public reference is the originating HackerOne report), and the vuln.today decision label is monitor with no CISA KEV listing.
Path traversal in the Linux networkStats() implementation of systeminformation before 5.33.14 allows a caller who controls the iface value, together with a locally planted directory of symlinked statistics files, to disclose the first line of any file readable by the Node.js process. The package exposes no network endpoint, so reaching the vulnerable path requires local filesystem write access or a consuming application that forwards untrusted input into networkStats(); the demonstrated impact is limited to a single line of a readable file, and the Windows and macOS implementations are not described as affected. A public proof-of-concept reference is included in the GitHub advisory; it is not verified as working exploit code, and no active exploitation is indicated.
An information-disclosure flaw in the Nextcloud Tables app (versions 0.8.1 through 2.0.0) lets an authenticated user who holds only read-data access to a table retrieve the full list of share recipients and their permission levels by calling the share-listing endpoint directly. The web UI correctly blocks these users from viewing that information, but the endpoint itself never verifies manage-level permission, so a low-privileged account can enumerate affected users, groups and teams along with their access levels for any table it can reach. The disclosure is limited to sharing metadata - table content is not exposed beyond what the existing read-data grant already allows - and no public exploit code or active exploitation is identified at time of analysis, with a low CVSS base score (3.3 vendor / AV:N per independent assessment) and a monitor-level priority.
Unbounded, persistent memory retention in the russh SSH agent server (russh::keys::agent::server::serve) before 0.65.0 allows any process able to reach the agent socket to grow the agent's heap without limit by repeatedly submitting key-addition requests padded with SSH_AGENT_CONSTRAIN_CONFIRM (0x02) records. Each 1-byte record on the wire becomes a 56-byte retained Constraint::Confirm value inside the keystore, and because keys without a lifetime constraint never expire, that memory is never reclaimed for the life of the process. Severity is low and availability-only (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 3.3), the vendor fixed the issue in 0.65.0, there is no CISA KEV listing for this CVE, and the published GHSA advisory supplies a verified proof-of-concept harness rather than any indication of active exploitation.
Infinite-loop denial of service in Tanium Threat Response client extension and Endpoint Configuration Toolset Solution allows a local user with low privileges to hang the affected endpoint component, reducing availability only. Affected builds are Threat Response CX before 1.17.802, 1.18.2732, 1.19.2213, 1.20.2271, and 1.21.1673, and Endpoint Configuration Toolset Solution before 1.51.60, 1.59.50, and 1.71.25. The vendor has released fixes, no public exploit identified at time of analysis, no CISA KEV entry, and the issue is rated monitor priority.
Predictable session-token generation in the HTML5 KVM-over-IP console of the Supermicro MBD-X12SPI BMC/IPMI web interface (firmware 01.07.20) allows a remote attacker to guess a token issued by the web interface and hijack an active KVM session, gaining access to the console's display and input path. Per the assessed vector the flaw is network-reachable and unauthenticated (AV:N/PR:N), but exploitation is constrained by high attack complexity (the token must actually be guessed or predicted) and by the requirement that a legitimate KVM session already be in use (UI:R). It is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is 0.15% (4th percentile), consistent with a 'monitor' decision label and low real-world priority; the dominant limiting factor remains deployment, since BMC management interfaces are normally confined to an isolated management LAN.
Insufficient logging in Tanium Server branches 7.7.3, 7.8.2, and 7.8.4 can cause certain privileged operations to be incompletely recorded in audit logs, weakening forensic visibility and log integrity (CWE-778); the flaw requires high-privileged authenticated access (PR:H) and carries a low CVSS score of 2.7. No public exploit code has been identified at time of analysis, and Tanium has released fixed builds for all three affected branches.
A use-after-free memory-corruption flaw in the Tanium Threat Response Client Extension requires local access to a host plus pre-existing low-level privileges, and its worst outcome is partial availability loss of the client extension - no confidentiality or integrity impact. Tanium has released fixed builds across the Endpoint Configuration Toolset Solution (1.51, 1.59, 1.71 branches) and multiple threat-response-cx branches per advisory TAN-2026-068. This is a low-priority issue: no public exploit code, PoC reference, or CISA KEV entry is present in the available data, and the priority label is monitor.
Out-of-bounds write in Asterisk's T.140 RED generation accumulation can corrupt memory, crash the process, or potentially enable code execution, but only for deployments running the legacy chan_sip channel driver with the non-default textsupport option enabled and only by an authenticated attacker sending crafted packets. The vendor CVSS 4.0 score is 2.3 and the independent assessment treats exploitation as high-complexity with low confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and the vuln.today priority is monitor.
Filesystem path disclosure in Tidewave Phoenix 0.8.0 through 0.9.1 lets a hostile web page read the framework's configuration tag - including the application root path, Mix dependency paths, project name and local port - either from the /tidewave/connect JSON response or from the toolbar meta tag injected into rendered HTML pages. Neither response validates the Host header, so a page that DNS-rebinds its own domain to the loopback address can retrieve the tag with a same-origin request, which carries no Origin header, exposing the developer's local username and project layout. The issue is unauthenticated per the CVSS vector but requires the victim to visit the attacker's page; impact is limited to low-sensitivity reconnaissance (confidentiality only, no code execution or access gain), no public exploit code was identified at time of analysis, and the vendor fix is version 0.9.2.
Memory corruption and denial of service in Asterisk's optional SMS dialplan application can be triggered when malformed SMS protocol data supplies length or user-data-header fields that overflow fixed in-struct buffers in app_sms.c. Asterisk 20.x through 20.20.0, 21.x through 21.12.2, 22.x through 22.10.0, 23.x through 23.4.0, and Certified Asterisk 20.7-cert10 and 22.8-cert2 and earlier are affected; exploitation requires the SMS application to be explicitly deployed (meaningful mainly for analog-device routing) and requires some authorized access to the SMS path, with the advisory also requiring that administrators have not ensured the data passed to the application is valid. The vendor has released fixed versions, the confirmed impact is a crash or memory corruption affecting availability, and no public exploit or active exploitation is identified at time of analysis, so the priority is monitor.
Memory exhaustion in the pageant crate's raw PageantStream transport affects versions 0.2.0 through 0.2.4: PageantStream::new reads a peer-supplied four-byte length prefix and buffers up to len + 4 bytes without checking it against the fixed 8 KiB _AGENT_MAX_MSGLEN transport limit, so a malicious SSH server can claim a frame of up to ~4 GiB and either stream that much data or stall mid-frame, keeping the partial buffer resident. Exploitation is narrowly scoped - Windows only, and only for applications that bridge an SSH forwarded-agent channel directly to the raw stream (e.g. copy_bidirectional); russh's typed AgentClient path bounds frames at 256 KiB and is not affected. The advisory includes a proof-of-concept that the reporter observed growing a pageant 0.2.4 process from ~7.4 MB to ~264.7 MB working set on Windows 11; the flaw is fixed in pageant 0.2.5, no CISA KEV entry or active exploitation is reported, and the priority label is monitor with an assessed CVSS 3.1 of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
Heap buffer overflow in Asterisk's T.140 RED handling (res_rtp_asterisk.c) lets an authenticated attacker crash the PBX or potentially execute code, but only in deployments where the legacy chan_sip channel driver is installed and configured with its non-default textsupport option enabled. Exposure is sharply narrow because chan_sip was deprecated in Asterisk 20 and removed from all later release tracks, so only Asterisk 20.x and the Certified 20.7 and 22.8 branches are realistically exploitable; the trigger requires a valid authenticated session (PR:L) plus a non-default configuration. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the reported CVSS 4.0 score is 2.3 with a 'monitor' priority label, consistent with a low-priority defect rather than an actively exploited one.
REDAXO backend sessions in versions up to and including 5.21.4 survive a password change: the fix in 5.21.5 shows that the current session id was not regenerated and, when 'stay logged in' was enabled, its stay-logged-in key was left valid for up to three months. An attacker who has already obtained the victim's PHP session id or stay-logged-in cookie through a separate vector - malware, a shared computer, or another flaw - therefore keeps backend access after the legitimate user changes their password, while only the user's other sessions are dropped. Both credentials live in HttpOnly cookies and theft of one is an explicit precondition, so this is a persistence weakness rather than an entry point; no public exploit code has been identified at time of analysis, exploitation is not confirmed and SSVC marks it non-automatable, and the vendor notes that simply logging out after the password change removes the session and its key.
Cross-origin information disclosure in the Vaadin Flow server-push endpoint allows a page on any origin to make a credentialed request to an authenticated user's push endpoint and read the response, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor echoes the request Origin into Access-Control-Allow-Origin while permitting credentials. Exposure is narrow: only applications using @Push over a non-WebSocket (HTTP/long-polling) transport are affected, and reading anything useful beyond triggering the request also requires the target session's push identifier, which is why CVSS 4.0 scores the issue only 2.3 and the priority decision is 'monitor'. No public exploit code was identified at time of analysis and there is no KEV listing or EPSS score in the available data.
Reflected cross-site scripting in the REDAXO backend packages API affects core releases before 5.21.0, where the `function` request parameter is concatenated into an 'Unknown package function' exception message and rendered by rex_view::error() without HTML escaping. Exploitation is heavily constrained: the crafted request must carry a valid session-bound CSRF token for the packages API and the victim must follow the resulting backend link while logged in, so the vendor scores confidentiality, integrity and availability impact as low (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N). A proof-of-concept script that assembles the exploitation link is included in the GitHub security advisory, but it requires an already-valid backend PHPSESSID to harvest the token; the issue is not in CISA KEV and the vuln.today priority decision is monitor rather than act-now.
Reflected cross-site scripting in REDAXO core before 5.21.0 lets an attacker with an authenticated backend session and metainfo privileges craft a link that injects HTML through the type parameter, which rex_view::message() renders unescaped in a victim's backend session. Exploitation also requires a valid per-session CSRF token and a backend user who opens the crafted link; CVSS 4.0 score is 2.1, SSVC records no exploitation and automatable: no, the vuln.today priority label is monitor, and the independent assessment rates real-world risk low. A public PoC reference exists in the GitHub advisory but is not independently verified as working exploit code; REDAXO 5.21.0 fixes the issue.
Stored cross-site scripting in REDAXO 5.18.0 through 5.21.3 allows an authenticated backend user with mediapool upload or edit rights to leave a script-bearing SVG publicly served from /media/, where a victim who opens the raw file can execute script in the backend origin. The flaw is a move-before-sanitize ordering issue: the race path is explicitly unreliable, while the persistent path depends on the sanitizer exhausting memory_limit or max_execution_time, and backend-session impact also assumes a single-domain deployment where /media/ shares the backend origin. No public exploit was identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, the decision signal is monitor, and REDAXO 5.21.4 contains the vendor fix.
Inconsistent HTTP response framing in CPython's http.client allows a malformed Content-Length header or chunked chunk-size field - for example '+5', '5_0', '0x5', '1_f', '-5' or a leading-space value - to be accepted by Python's permissive int() parsing while a strict RFC 9112 peer rejects or frames it differently, so an application can misinterpret HTTP response contents. The exposure is limited to deployments where CPython below 3.16.0 parses responses that also traverse a strict intermediary such as a proxy or cache, and to applications that pass attacker-influenced responses into http.client (directly or via libraries built on it); the vendor's CVSS 4.0 score is 2.0 with only low integrity impact on the subsequent system and no confidentiality or availability effect, and the independent assessment likewise treats it as low priority. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; the issue is rated 'monitor' in the vuln.today priority scheme.
Out-of-bounds write in Qt QTextCodec's iconv-based encoding path, exposed through the Qt 5 Compatibility APIs (qt5compat), can crash an affected application and may produce limited data-integrity effects when it encodes attacker-influenced text. Exposure is limited to applications built against qt5compat that use the iconv-based QTextCodec encoding path and fall within the listed Qt version ranges; the exact triggering condition is not described in available sources. The issue is assessed as low priority (decision label: monitor), with no public exploit identified at time of analysis and patch availability reported by the vendor.
Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a</x>") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159.
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159.
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159.
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159.
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159.
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159.
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159.
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissions.
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later rendered using React’s dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious OpenAPI schema containing HTML or JavaScript markup and trick a user into loading it through the Plugin Editor, resulting in arbitrary JavaScript execution in the NextChat origin. Successful exploitation allows access to JavaScript‑readable cookies and other client‑side data associated with the NextChat application.
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user.
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159.
Other issue in the SVG component. This vulnerability was fixed in Firefox 159.
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159.